Miscellaneous Flashcards
What is Measurable Security ?
“All aspects of security mechanisms function, provide a clear benefit, & have metrics that can be recorded & analyzed.”
What ensures proper creation, implementation, & enforcement of a security policy?
Security Management Planning
Which kind of approach to building security policy is generally frowned upon by experts?
A bottom-up approach.
What are some elements of Threat Mode Diagrams ?
- Trust Boundaries
- Dataflow Paths
- Input Points
- Privileged Operations
- Details about Security Stance/Approach
What is DREAD ?
Rating for threats: Disaster, Reproducibility, Exploitability, Affected Assets, Discoverability).
What is the focus of Risk Assessment ?
Assets, and potential loss of or damage to assets.
What are three Threat Modeling approaches?
- Focused on Assets
- Focused on Attackers
- Focuses on Software
What is STRIDE ?
Microsoft Threat Model.
- Spoofing
- Tampering
- Repudiation
- Info Disclosure
- DoS
- Elevation of Privileges
What is PASTA ?
Risk-centric Threat Model
Stage 1: Definition of objectives (DO)
Stage 2: Define Tech Scope (DTS)
Stage 3: App Decomposition & Analysis (ADA)
Stage 4: Threat Analysis (TA)
Stage 5: Weakness & Vulnerability Analysis (WVA)
Stage 6: Attack Modeling & Simulation (AMS)
Stage 7: Risk Analysis & Management (RAM)
What is VAST ?
Visual, Agile, & Simple Threat Modeling
Differentiate Due Diligence & Due Care
Due Diligence is planning
Due Care is doing
What is a Security Policy ?
Overview/Generalization of an organization’s security needs. Covers:
- Scope of the security needed
- Assets that need protection
- Extent to which security should go to protect assets
Security Policies are required to show due diligence.
What are COBIT’s Six Principles?
- Provide Stakeholder Value
- Use a holistic approach
- Have a dynamic governance system
- Keep governance separate from management
- Tailor security to enterprise needs
- Use an end-to-end governance system
List some security frameworks
- NIST 800-53 rev5 (Security & Privacy Controls for Information Systems and Organizations)
- CIS (Center for Internet Security)
- NIST Risk Management Framework (RMF)
- NIST CSF (Cybersecurity Framework)
- ISO 27000 series
- ITIL (from the British Government)
Who should lead an InfoSec Team?
A CISO.
What is the key to any security plan?
Approval by Senior Management
What are the three levels of security planning?
Strategic, Tactical, Operational
What are some steps in reviewing potential security integration partners?
- On-site assessment
- Document Exchange & Review
- Process Policy Review
- 3rd-party audit
What document from partners/vendors goes into your SLA?
SLR (Service Level Reporting)
What is COBIT ?
Control Objectives for Information & Related Technology (From ISACA, the Information Systems Audit & Control Association)
What are the sections of the CISSP Exam?
- Security and Risk Management
- Asset Security
- Security Architecture and Engineering
- Communication and Network Security
- Identity and Access Management (IAM)
- Security Assessment and Testing
- Security Operations
- Software Development Security
